Connect a Layer 3 switch to the Sangfor NGAF to manage the internal network, which will include PCs and servers.

Set up basic bidirectional NAT policies in Sangfor NGAF to map public IP addresses to private IP addresses and vice versa. This will allow internal users to access external resources and external users to access internal resources. You can refer to the Sangfor Technologies forum post on configuring basic bidirectional NAT for more information

Configure DNAT policies in Sangfor NGAF to publish servers and map the services of LAN servers to the internet. This will enable internet users to access internal resources, such as web servers or email servers, by mapping the public IP address to the private IP address of the server. You can watch Sangfor NGFW DNAT Configuration videos on YouTube for detailed guidance

Set up basic network security policies in Sangfor NGAF to control traffic flow and protect your organization from potential threats. You can find a video tutorial on configuring basic network security policy in Sangfor NGAF on YouTube

Yes, one-to-one networking is feasible (for example, you can map your live IP address to your local IP address so that your server can access it from anywhere).
Accessed POLICY, NAT, and DNAT.
For your assistance, a screenshot is also included.

Please contact Sanfor Technical Support for this kind of issues.

Yes, you can configure 1-to-1 NAT (also known as Static NAT) in Sangfor NGAF. Here are some instructions on how to configure it:

1. Access the NGAF Web Interface:

    Open a web browser and navigate to the NGAF's management IP address.
    Log in using your administrator credentials.

2. Navigate to the NAT Configuration:

    The exact menu structure might vary depending on your NGAF version, but generally, you'll find NAT configuration under sections like:
        Network > NAT
        Security Policy > NAT
        Firewall > NAT

3. Create a New NAT Rule:

    Locate the option to create a new NAT rule.
    Select the appropriate NAT type, which will usually be labeled as:
        Static NAT
        1-to-1 NAT
        One-to-One NAT
    (Image not available, but you'll see a field to select the NAT type.)

4. Define the Translation:

    Specify the following details:
        Original IP Address/Range: The private IP address or range you want to translate.
        Translated IP Address: The public IP address to which you want to map the private IP.
        Interface: The interface on which you want the NAT rule to apply (e.g., WAN interface).
        Protocol: The protocol for which the NAT rule should apply (usually TCP/UDP or both).
        (Image not available, but you'll fill in fields for these details.)

5. Apply the Rule (Optional):

    Some NGAF versions might require you to explicitly apply or enable the rule after creating it.

6. Save and Test:

    Save the NAT configuration.
    Test by attempting to access the translated IP address from the outside network.

Key Points:

    DNAT: While DNAT (Destination NAT) is a related concept, it's typically used for mapping public IPs to internal servers. 1-to-1 NAT is more common for translating private IPs to public ones.
    Documentation: Refer to your specific NGAF version's documentation for the exact menu structure and terminology.
    Testing: Thoroughly test the NAT configuration to ensure it's working as expected.

Sangfor NGAF used the DNAT. Same function as 1 to 1 NAT.
https://community.sangfor.com/pl ... atabase&tid=300